GSA_kwCzR0hTQS1jbW04LWd3NG0tMjZjd84ABKfi

Low EPSS: 0.00036% (0.08804 Percentile) EPSS:

Permalink JSON

JHipster allows privilege escalation via a modified authorities parameter

Affected Packages	Affected Versions	Fixed Versions
npm:generator-jhipster	< 8.9.0	8.9.0
198 Dependent packages 12,842 Dependent repositories 103,484 Downloads last month Affected Version Ranges All affected versions 0.0.1, 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.0.8, 0.0.9, 0.0.10, 0.0.11, 0.0.12, 0.0.13, 0.0.14, 0.0.15, 0.0.16, 0.0.17, 0.0.18, 0.0.19, 0.0.20, 0.0.21, 0.0.22, 0.0.23, 0.0.26, 0.0.27, 0.0.28, 0.0.29, 0.1.0, 0.2.0, 0.2.1, 0.3.0, 0.3.1, 0.4.0, 0.5.0, 0.5.1, 0.5.2, 0.6.0, 0.6.1, 0.6.2, 0.7.0, 0.7.1, 0.8.0, 0.8.1, 0.8.2, 0.8.3, 0.8.4, 0.9.0, 0.9.1, 0.9.2, 0.9.3, 0.10.0, 0.10.1, 0.11.0, 0.12.0, 0.13.0, 0.14.0, 0.15.0, 0.16.0, 0.17.0, 0.17.1, 0.17.2, 0.18.0, 0.18.1, 1.0.0, 1.1.0, 1.1.1, 1.2.0, 1.2.1, 1.2.2, 1.3.0, 1.4.0, 1.5.0, 1.6.0, 1.7.0, 1.7.1, 1.8.0, 1.8.1, 1.9.0, 1.10.0, 1.10.1, 1.10.2, 2.0.0, 2.1.0, 2.1.1, 2.2.0, 2.3.0, 2.4.0, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.7.0, 2.8.0, 2.9.0, 2.9.1, 2.9.2, 2.10.0, 2.10.1, 2.11.0, 2.11.1, 2.12.0, 2.13.0, 2.13.1, 2.14.0, 2.14.1, 2.14.2, 2.15.0, 2.15.1, 2.15.2, 2.16.0, 2.16.1, 2.17.0, 2.18.0, 2.19.0, 2.20.0, 2.21.0, 2.21.1, 2.22.0, 2.23.0, 2.23.1, 2.24.0, 2.25.0, 2.26.0, 2.26.1, 2.26.2, 2.27.0, 2.27.1, 2.27.2, 3.0.0, 3.1.0, 3.2.0, 3.2.1, 3.3.0, 3.4.0, 3.4.1, 3.4.2, 3.5.0, 3.5.1, 3.6.0, 3.6.1, 3.7.0, 3.7.1, 3.8.0, 3.9.0, 3.9.1, 3.10.0, 3.11.0, 3.12.0, 3.12.1, 3.12.2, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7, 4.0.8, 4.1.0, 4.1.1, 4.2.0, 4.3.0, 4.4.0, 4.4.1, 4.5.0, 4.5.1, 4.5.2, 4.5.3, 4.5.4, 4.5.5, 4.5.6, 4.6.0, 4.6.1, 4.6.2, 4.7.0, 4.8.0, 4.8.1, 4.8.2, 4.9.0, 4.10.0, 4.10.1, 4.10.2, 4.11.0, 4.11.1, 4.12.0, 4.13.0, 4.13.1, 4.13.2, 4.13.3, 4.14.0, 4.14.1, 4.14.2, 4.14.3, 4.14.4, 4.14.5, 5.0.0, 5.0.1, 5.0.2, 5.1.0, 5.2.0, 5.2.1, 5.3.0, 5.3.1, 5.3.2, 5.3.3, 5.3.4, 5.4.0, 5.4.1, 5.4.2, 5.5.0, 5.6.0, 5.6.1, 5.7.0, 5.7.1, 5.7.2, 5.8.0, 5.8.1, 5.8.2, 6.0.0, 6.0.1, 6.1.0, 6.1.1, 6.1.2, 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.4.1, 6.5.0, 6.5.1, 6.6.0, 6.7.0, 6.7.1, 6.8.0, 6.9.0, 6.9.1, 6.10.0, 6.10.1, 6.10.2, 6.10.3, 6.10.4, 6.10.5, 7.0.0, 7.0.1, 7.1.0, 7.2.0, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.6.0, 7.7.0, 7.8.0, 7.8.1, 7.9.0, 7.9.1, 7.9.2, 7.9.3, 7.9.4, 8.0.0, 8.1.0, 8.2.0, 8.2.1, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.7.0, 8.7.1, 8.7.2, 8.7.3, 8.8.0 All unaffected versions 8.9.0, 8.10.0, 8.11.0

JHipster before v.8.9.0 allows privilege escalation via a modified authorities parameter. Upon registering in the JHipster portal and logging in as a standard user, the authorities parameter in the response from the api/account endpoint contains the value ROLE_USER. By manipulating the authorities parameter and changing its value to ROLE_ADMIN, the privilege is successfully escalated to an Admin level. This allowed the access to all admin-related functionalities in the application.

References:

Identifiers

GHSA-cmm8-gw4m-26cw

CVE-2025-43712

Risk

Severity

Low

EPSS

EPSS Percentage: 0.00036

EPSS Percentile: 0.08804

Classification

General

Source

GitHub Advisory Database

Origin

Unspecified

Repository

https://github.com/jhipster/generator-jhipster

Date and time

Published

4 days ago

Updated

about 24 hours ago

API

JSON

ecosyste.ms

Data

Tools

Indexes

Applications

Experiments

Advisories